The Content Security Policy was delivered without the frame-ancestors directive.